my thought is that if rsyslog is getting blocked (queues full) then it will stop
accepting new logs via unix sockets.
can you enable impstats and see if you have any reports of the main queue being
full during the times that this happens?
full configs for rsyslog could identify if there is anything you have there that
is likely to block for extended times.
David Lang
On Sun, 17 Sep 2023, TG Servers via rsyslog wrote:
Hi,
ever since I started logging to a UDS from my nginx I get the occasional
111 in my nginx error logs.
As I literally don't have any other information or log entries I
honestly do not know how to debug this.
The thing is requests one second, or a few seconds later are processed
totally fine, so it cannot be a general problem, nor a access problem or
a permission problem.
I would be glad if anyone could help on fixing this
Examples:
error.log:2023/09/17 02:41:59 [error] 346192#346192: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 02:41:59 [error] 346191#346191: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 02:52:19 [error] 346192#346192: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 04:09:44 [error] 346193#346193: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 04:09:45 [error] 346185#346185: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 04:20:20 [error] 346186#346186: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 06:20:01 [error] 346182#346182: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 08:32:35 [error] 346182#346182: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 08:32:35 [error] 346188#346188: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 09:34:34 [error] 346183#346183: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 09:34:35 [error] 346183#346183: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
error.log:2023/09/17 16:00:25 [error] 346187#346187: send() failed (111:
Connection refused) while logging to syslog, server:
unix:/var/cache/nginx/rsyslog.socket
configuration for this single use case, of course there is a lot more in
rsyslog.conf
$AddUnixListenSocket /var/cache/nginx/rsyslog.socket
$template app,"%msg:2:$%"
if $programname == "app" then {
^/usr/local/script/app_log.sh;app
stop
}
The script app_log.sh does simply
echo "${@}" | /usr/bin/python <python_script>
Many thanks
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
